Please enable JavaScript.

Coggle requires JavaScript to display documents.

IMPLEMENTING MICROSOFT CREDENTIAL GUARD FOR ISO 27001, PCI, AND FEDRAMP…

- - - - ISO 27001: 2013
        
        A.9.2.4 - Management of Secret Authentication Information of Users
        
        A.9.3.1 - Use of Secret Authentication Information of Users
        
        A.9.4.1 - Information Access Restriction
        
        A.9.4.2 - Secure Logon Procedures
        
        A.9.4.3 - Password Management System
        
        A.10.1.2 - Key Management
        
        A.14.1.3 - Protecting Application Services Transactions
      - PCI DSS 3.2
        
        2.2.4 - Configure System to Prevent Misuse
        
        3.6.2 - Secure Cryptographic Key Distribution
        
        3.6.3 - Secure Cryptographic Key Storage
        
        3.6.7 - Prevention of Unauthorized Key Substitution
        
        8.1.2 - Control User IDs and Credentials
        
        8.2.1 -Protect User Credentials (Passwords)
        
        8.2.2 - Verify User Credential Modification
        
        8.6 - Protect User Credentials (Other Authenticators)
      - FedRAMP; NIST 800-53 Revision 4
        
        AC-3 - Access Enforcement
        
        AC-4 - Information Flow Enforcement
        
        AC-6 (10) - Least Privilege | Prohibit Non- Privileged Users from Executing Privileged Functions
        
        IA-2 (8) - Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts - Replay Resistant
        
        IA-5 - Authenticator Management
        
        IA-5 (6) - Authenticator Management | Protection of Authenticators
        
        IA-6 - Authenticator Feedback
        
        IA-7 - Cryptographic Module Authentication
        
        SC-2 - Application Partitioning
        
        SC-4 - Information in Shared Resources
        
        SC-12 - Cryptographic Key Establishment and Management
        
        SC-12 (2) - Cryptographic Key Establishment and Management | Symmetric Keys
    - - ISO 27001: 2013
        
        A.9.1.2 - Access to Networks and Network Services
        
        A.9.2.4 - Management of Secret Authentication Information of Users
        
        A.9.3.1 - Use of Secret Authentication Information of Users
        
        A.9.4.1 - Information Access Restriction
        
        A.9.4.2 - Secure Logon Procedures
        
        A.9.4.3 - Password Management System
        
        A.10.1.2 - Key Management
        
        A.13.1.2 - Security of Network Services
        
        A.14.1.2 - Securing Application Services of Public Networks
        
        A.14.1.3 - Protecting Application Services Transactions
      - PCI DSS 3.2
        
        2.2.3 - Enable Additional Control for Insecure Services, Protocols, Daemons
        
        2.2.4 - Configure System to Prevent Misuse
        
        3.6.2 - Secure Cryptographic Key Distribution
        
        3.6.3 - Secure Cryptographic Key Storage
        
        3.6.7 - Prevention of Unauthorized Key Substitution
        
        8.1.2 - Control User IDs and Credentials
        
        8.2.1 -Protect User Credentials (Passwords)
        
        8.2.2 - Verify User Credential Modification
        
        8.6 - Protect User Credentials (Other Authenticators)
      - FedRAMP; NIST 800-53 Revision 4
        
        AC-3 - Access Enforcement
        
        AC-4 - Information Flow Enforcement
        
        AC-6 (10) - Least Privilege | Prohibit Non- Privileged Users from Executing Privileged Functions
        
        AC-17 - Remote Access
        
        IA-2 (8) - Identification and Authentication (Organizational Users) | Network Access to Privileged Accounts - Replay Resistant
        
        IA-5 - Authenticator Management
        
        IA-5 (6) - Authenticator Management | Protection of Authenticators
        
        IA-6 - Authenticator Feedback
        
        IA-7 - Cryptographic Module Authentication
        
        SC-2 - Application Partitioning
        
        SC-4 - Information in Shared Resources
        
        SC-8 - Transmission Confidentiality and Integrity
        
        SC-8 (1) - Transmission Confidentiality and Integrity | Cryptographic or Alternate Physical Protection
        
        SC-12 - Cryptographic Key Establishment and Management
        
        SC-12 (2) - Cryptographic Key Establishment and Management | Symmetric Keys
        
        SC-23 - Session Authenticity